Solution
Use a basic SQL Injection ' or 1=1# and we got flag
Flag
nactf{1nj3c7ion5_ar3_saf3_in_th3_l4b}